Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

magento-lts

Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.

CVE-2026-25523 is a vulnerability identified in OpenMage magento-lts, a long-term support fork of Magento Community Edition, affecting versions prior to 20.16.1. The vulnerability arises from improper handling of the X-Original-Url HTTP header in certain server configurations, which allows an attacker to discover the location of the Magento admin URL without prior knowledge or authentication. This exposure constitutes an information disclosure issue categorized under CWE-200. By sending crafted HTTP requests that manipulate the X-Original-Url header, an attacker can bypass obscurity protections that typically hide the admin panel URL, thereby gaining sensitive information about the target system's administrative interface. The vulnerability does not directly compromise confidentiality, integrity, or availability of data but facilitates reconnaissance that could lead to more severe attacks such as brute force login attempts or exploitation of other vulnerabilities. The vulnerability has a CVSS v3.1 base score of 5.3 (medium), reflecting its network attack vector, low complexity, no privileges required, and no user interaction needed. The issue was publicly disclosed and patched in version 20.16.1 of magento-lts. No known exploits have been reported in the wild as of the publication date. The vulnerability’s impact is limited to information disclosure, but given the critical nature of admin URL secrecy in Magento deployments, it is a significant concern for organizations relying on magento-lts for e-commerce operations.

Detailed information about CVE-2026-25523: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in OpenMage magento-lts affecting OpenMage magent

CVE-2026-25523: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in OpenMage magento-lts - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-25523: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in OpenMage magento-lts

Threats Tagged 'cve-2026-25523'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-25523'

Lead Pen Test Professional